Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe
- Size 709KB
- Sample260808-e96vrahp3v
- SHA256 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd
- MD5 c807246624e9e6d61da0effcbe6c3a95
- SHA1 20827f876cd7a1b83536c32ac957b4d3048f7a0c
- SHA512 3ea404d8f789b4a8aad767b182c606bbae4d315d9aa4dbae70d3f9430fd4d802bb6116505fbfddf6c18754227da736d219c63eb0273b228acc1d5ca1550baa92
- SSDEEP 12288:8qOx8TBvmTL4KbrtKGymYBm4NNbrnSiVs6pHXNomPs+U9jk+:8qOxfT9pymcNNfS3womok+
- TLSH T19CF47BA033C80B5AE2BF0B75E4701588A776F856DFC7EF8F598290A91893781CD54B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncreaseQuotaPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSecurityPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeTakeOwnershipPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeLoadDriverPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemProfilePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemtimePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeProfSingleProcessPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncBasePriorityPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeCreatePagefilePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeBackupPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRestorePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeShutdownPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeDebugPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemEnvironmentPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRemoteShutdownPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeUndockPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeManageVolumePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 33 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 34 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 35 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 36 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncreaseQuotaPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSecurityPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeTakeOwnershipPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeLoadDriverPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemProfilePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemtimePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeProfSingleProcessPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncBasePriorityPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeCreatePagefilePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeBackupPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRestorePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeShutdownPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeDebugPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemEnvironmentPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRemoteShutdownPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeUndockPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeManageVolumePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 33 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 34 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 35 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 36 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncreaseQuotaPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSecurityPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeTakeOwnershipPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeLoadDriverPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemProfilePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemtimePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeProfSingleProcessPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncBasePriorityPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeCreatePagefilePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeBackupPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRestorePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeShutdownPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeDebugPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemEnvironmentPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRemoteShutdownPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeUndockPrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeManageVolumePrivilege 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 33 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 34 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 35 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 36 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3452 wrote to memory of 3208 3452 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 89 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe"C:\Users\Admin\AppData\Local\Temp\ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query /TN Pavise2⤵PID:3208
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Pavise\Pavise.log
- Size 642B
- SHA256 78cae40096bf7f4cda0ee94603243dc971278baa6c2fdbb52eddae0b5a47c2e2
- MD5 65cb6217a5eed2bff20a2b7df378b8ec
- SHA1 77022d3a40d591d505a135200c0166f444371f10
- SHA512 2097c5631c05c22790de06e43f8805a6749679e26f02f0ff3cfbb6fb98062a3fc0ce967c173cf6e475c48e2d8c71bdf301c8ae3191a7d5d02027c28c67faacff
- TLSH T148F0A2144FF705383A124D2D08C78E1C90853B08F308D6BAFF291E0E51C1E189AC5F46
- MD5 SHA1 SHA512 TLSH